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APOLLO EXPERIENCE REPORT 


GUIDANCE AND CONTROL SYSTEMS; MISSION CONTROL PROGRAMER 

FOR UNMANNED MISSIONS AS-202, APOLLO 4, AND APOLLO 6 

By Gene F. Holloway 
Lyndon B. Johnson Space Center 

SUMMARY 


The unmanned Apollo missions AS-202, Apollo 4, and Apollo 6 were successful 
flights. The flight objectives, which were a prerequisite for the manned Apollo 
missions, were accomplished for each mission. The mission control programer unit 
was successfully used for all three missions without causing a flight anomaly or the 
loss of any functional event for which the programer was responsible. The mission 
control programer met all the flight and ground test objectives without the loss or 
erroneous indication of any necessary output. The mission control programer did, 
however, experience individual component failures during the program. These few 
failures were compensated for in the redundant circuit design of the mission control 
programer and did not result in the loss of or deficiency in any necessary mission 
output. Because the mission control programer was designed for unmanned missions 
and a crew was not present to compensate for possible flight anomalies by switching to 
alternate backup systems or by using alternate mission modes, the mission control 
programer with its sometimes triply redundant paths was required to have higher inher- 
ent reliability than other Apollo' systems. The Apollo 4 mission control programer was 
reflown during the Apollo 6 mission. This unit was the first Apollo system to be 
reflown on a space-flight mission. 


INTRODUCTION 


The structure and heat- shield design of the Apollo command and service module 
(CSM) had to be verified under Saturn V launch and lunar- reentry environments before 
it could be considered man- rated. The mission control programer (MCP) was devel- 
oped by the NASA and the CSM prime contractor to provide the automatic event switch- 
ing interface between the input command and control systems (e. g. , the guidance and 
navigation (G&N) computer) and the output response systems for the Apollo unmanned 
test flights. The MCP also provided the real-time ground- control interface for backup 
attitude control and sequencing. The objective of this report is to document the MCP 
development program from the initial concepts and mission requirements phase; through 
the design and manufacturing buildup testing; during the spacecraft installation and 


tests; and, finally, through the launch, recovery, and postflight analysis. This Apollo 
experience resulted in useful information that should be adapted to the design of future 
unmanned space-flight equipment. 

The unmanned flight requirements for the MCP were identified by the interfacing 
subsystem design engineers and ground flight controllers. This report gives a mission 
time line for the Apollo 4 mission and demonstrates how this mission was accomplished 
using a few key commands from the G&N computer and using the internal logic and 
hardwired time delays of the MCP to drive or switch the interfacing spacecraft systems. 
The backup ground- control capability is listed together with a description of each real- 
time ground command. An example is given to show how the ground commands could be 
used to provide a backup thrust maneuver. 

The requirement to test each redundant path or system in the Apollo launch vehicle 
just before launch was an essential factor in the mission successes of the Apollo Pro- 
gram. This report discusses the problems that had to be resolved to perform these 
spacecraft redundancy tests on the MCP. 

During the MCP development, changes to the spacecraft were approved that 
required design changes to the MCP. Some of the spacecraft changes are listed in this 
report together with their effect on the MCP design. 

As an aid to the reader, where necessary the original units of measure have been 
converted to the equivalent value in the Systeme International d’Unites (SI). The SI units 
are written first, and the original units are written parenthetically thereafter. 


MISSION CONTROL PROGRAMER DESCRIPTION 


The MCP (fig. 1) consisted of three units; the spacecraft command controller 
(SCC; fig. 2), the ground command controller (GCC; similar to the SCC), and the 
attitude and deceleration sensor (ADS; fig. 3). These units were located in the space- 
craft on a platform assembly mounted in place of the crew couches on the crew couch 
shock mounts. The MCP weight was adjusted to approximately 163 kilograms 
(360 pounds) so that it could provide the weight necessary to verify the response of the 
crew couch struts to landing impacts. As shown in figure 4, the keying commands 
were supplied to the MCP by the G&N system, the Saturn IVB (S-IVB) instrumentation 
unit (lU), the updata link, and the launch control complex. The other interfacing 
systems actuated by the MCP output switching functions are also shown in figure 4. 
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I nput Keying Commands for Mission Sequencing 

The primary source of mission sequencing key commands to the MCP was the 
G&N system computer. The original keying commands furnished by the G&N computer 
were as follows. 

1. G&N abort 

2. Positive- or negative- Z antenna switching 

3. Flight director attitude indicator alinement 

4. Gimbal motors 

5. G&N fail 

6. O.OSg 

7. Positive-X translation 
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8, Command module (CM) and service module (SM) separation 

9. G&N entry mode 

10. G&N change in velocity AV mode 

11. G&N attitude control mode 



Figure 2. - Spacecraft command controller. 


The first two interface signals, G&N abort and positive- or negative- Z antenna switch- 
ing, were removed from the G&N wiring on spacecraft 017 and 020 because the failures 
that could produce either signal were considered to be single-point failures. The 
decision was made that, because the abort signal or relay closure could be erroneous, 
the G&N system computer should not automatically abort a mission. Because real-time 
ground commands were available to switch the antennas and because the G&N system 
computer controlled the spacecraft attitude during the mission midcourse flightpath. 
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the software task of programing the G&N system computer to switch antennas automat- 
ically was considered too costly for the results achieved. The diagram of the connector 
interface between the MCP and the G&N system computer (fig. 5) shows that the MCP 
provided the 28-V dc power supply for the G&N system relays, and the G&N system 
computer provided the logic and relay closures to complete the circuit paths. 



Figure 3.- Attitude and deceleration sensor. 


The S-IVB lU provided four keying commands for the MCP. The following list 
represents the S-IVB interface keying commands for mission sequencing. Each 
command was dually redundant. 

1. S-IVB restart A 

2. S-IVB restart B 

3. Launch escape tower jettison command A 

4. Launch escape tower jettison command B 

5. Lift-off signal A 
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6. Lift-off signal B 

7. Launch vehicle and spacecraft separation start A 

8. Launch vehicle and spacecraft separation start B 

Whenever the spacecraft direct- current bus was powered, the MCP provided redundant 
direct- current power to the S-IVB lU for the generation of the discrete sequencing 
signals (fig. 6). These keying signals from the lU were used by the MCP logic and 
internal time-delay circuits to provide the other required mission sequences. 


Thrust vector control 



Figure 4. - Block diagram of the MCP. 


A diagram of the logic circuitry of the interface between the MCP and the launch 
control and ground support equipment (GSE) is shown in figure 7. This interface pro- 
vided launch- control personnel with the capability to disarm the pyrotechnics, switch 
off the logic buses, and operate the onboard flight recorders while the spacecraft and 
launch vehicle were stacked at the launch site. The program reset signal of this con- 
trol interface allowed launch- control personnel to start the MCP; that is, to reset all 
latching relays and prepare the MCP logic circuit for lift-off. 
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Figure 5.- Diagram of the G&N system connector interface with the SCC. 
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Figure 6. - Diagram of the S-IVB lU interface with the SCC. 


Sequencing To Accomplish Mission Requirements 

After the MCP received the sequence keying commands from the input interfacing 
systems, the programer processed these commands through the internal relay- logic 
and time-delay circuitry to provide the proper output switching signal to the required 
spacecraft system (e. g. , the flight qualification recorder). 

The Apollo 4 mission events (summarized in table I) are typical of the other 
missions and are used as an example. The planned times for certain mission events, 
listed in the Apollo 4 Mission Report, varied as much as 28 seconds from the times 
that were predicted (table I) less than 3 months before the flight. These changes in the 
planned times of certain mission events demonstrate the dynamics of mission planning 
and the necessity of designing hardware with the flexibility needed to accomplish these 
mission changes. 

During the Earth- intersecting coast phase of the Apollo 4 mission, the CSM was 
alined in an attitude to achieve a specific thermal gradient (cold soak) across the heat 
shield. This spacecraft orientation was maintained for approximately 4. 5 hours before 
the CSM was reoriented for the second engine firing of the service propulsion system 
(SPS). The sequence of events leading up to and including the second SPS engine ignition 
will be discussed as an example. The detailed sequences to be discussed are between 


8 


time references tg and and between t^ and tg listed in table I and described in 

table II. These sequences, which were initiated by the G&N system computer, are not 
listed as specific times (hours, minutes, and seconds) but are given as reference 
symbols (t^, tg, tg, etc.). The detailed software programs for the G&N- system 

computer established these specific times for the various missions. 
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Figure 7. - Diagram of launch cont rol axxd GSE interface with the SCC. 
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TABLE I. - APOLLO 4 MISSION DISCRETE EVENTS SUMMARY 


Event 

Planned time 
from lift-off, 
hr ; min: sec 
(a) 

Actual time, 
hr : min: sec 

Saturn V ascent to orbit 



Guidance reference release 

00:00:16.70 

— 

Lift-off 

00:00:00.00 

00:00:00.263 

Saturn IC (S-IC) inboard engine 
cut-off 

00:02:15.50 

00:02:15.52 

S-IC outboard engine cut-off 

00:02:32.40 

00:02:30.77 

Saturn II (S-n) engine ignition 

00:02:35.20 

— 

S-IC interstage jettison 

00:03:04.35 

— 

Launch escape system jettison 

00:03:08.35 

— 

S-II engine cut-off^ 

00:08:39.55 

00:08:39.76 

S-IVB engine ignition*^ 

00:08:44.05 

00:08:40.72 

S-IVB engine cut-off'^ 

00:11:05.40 

00:11:05.64 

Earth parking orbit 



Start Earth parking orbit 

00:11:15.60 

00:11:15.6 

Start second orbit revolution 

01:38:20.00 

-- 

Second S-IVB firing 



S-IVB engine ignition'^ 

03:11:54.50 

03:11:26.6 

S-IVB engine cut-off'^ 

03:17:12.53 

03:16:26.3 

Coast to first service propulsion system 
(SPS) firing 



Begin reorientation to cold- soak 
attitude 

03:17:27.71 

— 

End of reorientation to cold- soak 
attitude 

03:20:42.81 


CSM/S-IVB separation 

03:27:14.43 

03:26:28.2 


^The planned times given are taken from AS- 501 Spacecraft Opera- 
tional Trajectory, Volume I — Trajectory Description, August 25, 1967. 

^Refers to guidance signal. 


10 



TABLE I. - APOLLO 4 MISSION DISCRETE EVENTS SUMMARY - Continued 


Event 

Planned time 
from lift-off, 
hr; min: sec 
(a) 

Actual time, 
hr : min: sec 

Begin reorientation to first SPS 
ignition attitude 

03:27:22.73 

— 

End of reorientation to first SPS 
ignition attitude 

03:27:51.81 

— 

First SPS firing 



SPS engine ignition*^ 

03:28:52.73 

03:28:06.6 

SPS engine cut-off^ 

03:29: 18.93 

03:28:22.6 

Earth intersecting coast 



Begin reorientation to cold- soak 
attitude 

03:29:24.68 

— 

End of reorientation to cold- soak 
attitude 

03:29:53.76 

— 

Apogee 

05:49:04.32 

— 

Begin reorientation to second SPS 
ignition attitude 

08:01:36.75 

= tg (note c) 

End of reorientation to second SPS 
ignition attitude 

08:02:01.05 

= t^ (note c) 

Reaction control system (RCS) 
thrusters on 

08:14:40.42 

— 

Second SPS firing 



Second SPS engine ignition*^ 

08:15:10.42 

08:10:54.8 
= t^ (note c) 

Second SPS engine cut-off*^ 

08:19:34.40 

08:15:35.4 
= tg (note c) 


3 - 

The planned times given are taken from AS- 501 Spacecraft Opera- 
tional Trajectory, Volume I — Trajectory Description, August 25, 1967. 

■j^ 

Kefers to guidance signal. 

Table n provides additional information. 
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TABLE I.- APOLLO 4 MISSION DISCRETE EVENTS SUMMARY - Concluded 


Event 

Planned time 
from lift-off, 
hr : min: sec 
(a) 

Actual time, 
hr: min: sec 

Preentry sequence 



Begin reorientation to CM/SM 
separation attitude 

08:20:12.97 

— 

End of attitude orientation, coast 
to CM/SM separation 

08:20:54.01 

— 

CM/SM separation 

08:22:07.85 

08:18:02.6 

Start CM attitude orientation for 
entry 

08:22:12.85 

— 

End of attitude orientation, coast 
to entry 

08:22:36.03 

08:18:06.28 

Atmospheric entry 



0. 05g indication 

— 

08:19:56.28 

121 920-m (400 000 ft) altitude 

08:23:35.02 

-- 

Enter S-band blackout 

08:23:57.00 

— 

Enter C-band blackout 

08:24:01.00 

— 

Exit C-band blackout 

08:25:55.00 

-- 

Exit S-band blackout 

08:26:19.00 

-- 

Enter S-band blackout 

08:30:15.00 

— 

Exit S-band blackout 

08:31:47.00 

— 

Drogue-parachute deployment 

08:35:39.00 

08:31:18.6 

Main-parachute deployment 

08:36:27.00 

— 

CM landing 

08:41:25.00 

— 


^he planned times given are taken from AS- 501 Spacecraft Opera- 
tional Trajectory, Volume I — Trajectory Description, August 25, 1967. 
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TABLE II.- NOMINAL MISSION SEQUENCE OF EVENTS 
FOR SECOND SPS FIRING 


Time 

reference 

Initiated 
by — 

MCP 

function 

Function 

Output 
to — 

Reorientation to second SPS ignition attitude 

‘a 

G&N 

X 

Monitor mode OFF and G&N attitude 
control mode ON 

SCS^ 


G&N 


Initiate pitch maneuver 

SCS 

*C 

G&N 


Complete pitch maneuver 

SCS 


G&N 

X 

Flight director attitude indicator 
aline ON 

SCS 

*E 

G&N 

X 

Flight director attitude indicator 
aline OFF 

SCS 

Second SPS thrust maneuver 

*0 

G&N 

X 

G&N attitude control mode OFF and 
monitor mode ON 

SCS 


G&N 

X 

Monitor mode OFF and G&N AV 
mode ON 

SCS 

*2 

G&N 

X 

Positive-X translation ON 

SCS 

*3 

G&N 

X 

Gimbal motors ON 

MCP 


MCP 

X 

Entry batteries to main dc buses 

EPS^ 


MCP 

X 

Flight qualification recorder ON 

T/C^ 


MCP 

X 

Prepilot valve A ON 

SPS 


MCP 

X 

Data storage equipment recorder ON 

T/C 


MCP 

X 

Prepilot valve B ON 

SPS 

tg + 1.0 sec 

MCP 

X 

Yaw 1 gimbal motor start 

SPS 


2 ^ 

stabilization and control system. 

^Electrical power system. 

(> 

Transmitting and control function. 
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TABLE n. - NOMINAL MISSION SEQUENCE OF EVENTS 
FOR SECOND SPS FIRING - Concluded 


1 

Time 

reference 

Initiated 
by — 



MCP 

function 

Function 

Output 
to — 

Second SPS thrust maneuver - Concluded 

1 

tg + 1.5 sec 

MCP 

X 

Yaw 1 gimbal motor ON 

SPS 


MCP 

X 

Pitch 1 gimbal motor start 

SPS 

tg + 2.0 sec 

MCP 

X 

Pitch 1 gimbal motor ON 

SPS 


MCP 

X 

Yaw 2 gimbal motor start 

SPS 

tg + 2. 5 sec 

MCP 

X 

Yaw 2 gimbal motor ON 

SPS 


MCP 

X 

Pitch 2 gimbal motor start 

SPS 

tg + 3.0 sec 

MCP 

X 

Pitch 2 gimbal motor ON 

SPS 

.. 

G&N 


SPS thrust ON (second firing) 

SCS 


G&N 

X 

Positive- X translation OFF 

SCS 

^6 

G&N 


SPS thrust OFF 

SCS 


G&N 

X 

Gimbal motors OFF 

MCP 

tg + 3.0 sec 

MCP 

X 

Gimbal motors OFF 

SPS 


MCP 

X 

Remove entry batteries from main 
buses 

EPS 


MCP 

X 

Select third gimbal position set 

SCS 


MCP 

X 

Prepilot valve A OFF 

SPS 


MCP 

X 

Prepilot valve B OFF 

SPS 


G&N 

X 

i 

G&N AV mode OFF and monitor 
mode ON 

SCS 
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The MCP was designed with the specification that the initiation times for partic- 
ular keying and sequencing commands for performing various mission functions could 
be changed from mission to mission. However, the detailed integrated sequence of 
events to accomplish any particular mission function would remain consistent for all 
missions. Table II lists the functions required to reorient the spacecraft to the second 
SPS engine ignition attitude and the functions required to initiate and complete the 
second thrust maneuver. The MCP time delays are shown in the time- ref erence 
column. For example, "tg + 1.0 sec" indicates that the "yaw 1 gimbal motor start" 

signal from the MCP to the SPS gimbal actuator motor occurred 1. 0 second after the 
G&N system computer had given the "gimbal motors ON" signal (tg) to the MCP. The 

time- delay units were hardwired, potted plug-in modules that were hermetically sealed 
in a metal case. Several time- delay selections were available for a given module base 
connection size. Because of the high- start- current requirements of the motors, the 
gimbal motors were turned on at 0. 5- second intervals to prevent an electrical overload. 
Table II gives a function- by- function description of the spacecraft system activity 
required to perform an SPS thrust maneuver. A similar functional listing can be 
obtained for all the required mission events, including abort sequencing. 

At time tg, the MCP turned on the flight qualification recorder and the data- 
storage-equipment recorder. The sequences of events that were considered the most 
critical or of the highest priority and that were to be recorded varied significantly 
from mission to mission. The recorders and cameras had a limited tape and film 
capacity; and timed on-off sequences, which varied significantly from mission to 
mission, were necessary to obtain only the most important data. These changes in 
sequence times required MCP hardware changes. Usually, the times varied so much 
that different connector interface circuits had to be selected for the keying commands 
(e. g. , a command for a second SPS firing gimbal motors off instead of a command for 
S-IVB/spacecraft separation). These MCP hardware modifications were costly in 
terms of money and schedule time, requiring new engineering drawings, specification 
revisions, test equipment modifications, recertification of the test equipment, and 
reacceptance testing of the flight hardware. In future manned or unmanned develop- 
mental flight programs, strong emphasis should be given to the developmental instru- 
mentation interface with the spacecraft systems. For launch vehicles or spacecraft 
that contain flight computers, the instrumentation used to monitor flight events during 
the developmental program should be designed so that the changes of instrumentation 
sequences from mission to mission can be placed in the erasable portion of the comput- 
er memory. If this procedure were followed, the sequences could be quickly and cheap- 
ly modified in real time. 


Real-Time Commands for Ground Control 

The MCP, through the GCC unit, provided the switching logic circuitry, the 
relays, the relay drivers, and the required spacecraft system interface and had the 
capability to process 77 ground- commanded signals received by the spacecraft through 
the digital updata link. This technique provided a backup performance capability to the 
spacecraft by using ground support personnel and their flight control consoles to provide 
the updata- link signal commands. A list of the titles and number codes of possible real- 
time commands is given in table III. The number codes correspond to the appropriate flight 
control console switches in the Mission Control Center for the uplinked transmissions. 
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TABLE III.- REAL-TIME COMMANDS 


Real-time 

command 

number 

Title 

01 

Abort light (system A) ON 

00 

Abort light (system A) OFF^ 

07 

Abort light (system B) ON^ 

06 

Abort light (system B) OFF^ 

02 

Fuel cell 1 purge 

03 

Fuel cell 2 purge 

04 

Fuel cell 3 purge 

05 

Reset real-time command numbers 02 to 04 

10 

Lifting entry 

11 

Direct thrust ON 

12 

Direct thrust OFF 

13 

Reset real-time command numbers 10 to 12 

14 

Positive pitch direct rotation 

15 

Negative pitch direct rotation 

16 

Positive yaw direct rotation 

17 

Negative yaw direct rotation 

20 

Positive roll direct rotation 

21 

Negative roll direct rotation 

22 

Direct ullage 

23 

Reset real-time commands 14 to 22 

24 

Propellant OFF SM quad A 

25 

Propellant OFF SM quad B 

26 

Propellant OFF SM quad C 

27 

Propellant OFF SM quad D 

32 

Propellant ON SM quad A 

33 

Propellant ON SM quad B 


^ot used. 
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TABLE m. - REAL-TIME COMMANDS - Continued 


Real-time 

command 

number 

Title 

34 

Propellant ON SM quad C 

35 

Propellant ON SM quad D 

40 

Launch escape tower jettison 

41 

G&N fail 

42 

G&N fail inhibit 

43 

Reset real-time command numbers 41 to 42 

44 

Roll rate backup 

45 

Pitch rate backup 

46 

Yaw rate backup 

47 

Flight director attitude indicator aline 

50 

Reset real-time commands 44 to 47 

51 

Negative- Z antenna ON (very-high-frequency (vhf) 
scimitar only) 

52 

Positive- Z antenna ON (vhf scimitar only) 

54 

Roll A and C channel disable 

55 

Roll B and D channel disable 

56 

Pitch channel disable 

57 

Yaw channel disable 

60 

Reset real-time command numbers 54 to 57 

61 

CM and SM separation 

62 

Updata link S-band receiver select 

63 

Updata link ultrahigh-frequency receiver 
select 

64 

Hydrogen tank 2 heater fan ON 

65 

Oxygen tank 2 heater fan ON 

66 

Hydrogen tank 1 heater fan ON 

67 

Oxygen tank 1 heater fan ON 

70 

Reset real-time command numbers 64 to 67 



TABLE III. - REAL-TIME COMMANDS - Concluded 


Real-time 

command 

number 

Title 

71 

Launch escape tower abort and MCP separation 

73 

Spare 

74 

C-band OFF 

75 

C-band ON (2 pulse) 

76 

vhf transmitter OFF 

77 

vhf transmitter ON 


Real-time commands 14 to 21, 23, and 54 to 60 were to be used to control the 
spacecraft attitude if the automatic attitude control provided by the G&N system had not 
functioned properly. If this malfunction had occurred, the automatic channels to the 
reaction control system (RCS) could have been disconnected by real-time commands 
54 to 60, and the direct rotation commands, real-time commands 14 to 21, could have 
been transmitted. The direct rotation commands required that the ground controllers 
transmit the time interval necessary to achieve the desired spacecraft attitude. For 
example, if the G&N system had failed, the second SPS firing sequence could have been 
accomplished by ground controllers using real-time commands according to the follow- 
ing sequence. 

1. Send real-time command 41, "G&N fail. " 

2. Use real-time commands 14 to 21 to position the vehicle to the proper firing 
attitude. 

3. Send real-time command 11, "direct thrust ON, " at the desired firing time to 
automatically start the gimbal motors in sequence and to initiate the firing. 

4. Monitor the spacecraft trajectory by using the Mission Control Center real- 
time tracking data. 

5. Send real-time command 12, "direct thrust OFF, " at some predetermined 
velocity point or at the violation of a limit line on the trajectory plot, 

6. The vehicle probably would be oriented for CM and SM separation by the 
real-time commands cited in step 2. Such a probability would be consistent with the 
example that the G&N system had failed; therefore, additional mission objectives would 
not be attempted. 
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7. Send real-time command 61, "CM and SM separation, " to arm the master 
events sequence- controller (MESC) logic circuitry, to arm the pyrotechnic devices, 
and to initiate the separation sequence. 

8. The vehicle would be oriented for entry. 

The advantages of retaining a degree of real-time ground control of the spacecraft 
would have been demonstrated if a spacecraft system failure had actually occurred 
during one of the flights. If the G&N system had malfunctioned, some useful heat- shield 
data at the required high- entry velocities still could have been obtained. Several com- 
binations of spacecraft sequencing and control, other than that of the G&N system mal- 
function, could be accomplished by real-time commands. The flight operation plans 
and the launch rules for each mission furnish a description of the many possible alter- 
nate mission modes. Several real- time- command numbers are intentionally omitted 
from table III. The following real-time commands were deleted by the NASA before 
the Apollo 4 and 6 missions. 


Number 

Title 

30 

CM RCS system A propellant OFF 

31 

CM RCS system B propellant OFF 

36 

CM RCS system A propellant ON 

37 

CM RCS system B propellant ON 

53 

G&N antenna switching 


Backup 0.05g Acceleration Sensor 

Several significant mission events were required between the entry phase and the 
landing (table IV). The sensing of the point of atmospheric entry (the point at which 
0. 05g deceleration is reached, which occurred at an altitude of approximately 
88 400 meters (290 000 feet) is a critical mission event for recovery of the spacecraft. 
The primary determination of the entry point (0. 05g) was made by the G&N system, 
and a redundant 0. 05g signal was provided in case the G&N system failed to provide 
this signal or in case the G&N system had failed earlier in the mission. This redundant 
signal was produced by accelerometers in the ADS unit of the MCP. Table IV shows 
the MCP transferring the 0. 05g signal from the G&N system to the stabilization and 
control system (SCS) at t^. The importance of accurately determining the point at 

which 0. 05g was reached cannot be overemphasized, because, after this point is passed, 
the method of controlling the spacecraft with the RCS thrusters is changed. The pitch 
and yaw attitude control was inhibited by the SCS, and the spacecraft was steered by 
using the RCS thrusters to roll the spacecraft about an offset center of gravity. Other 
important spacecraft systems (e.g. , the Earth- landing system (ELS)) were also acti- 
vated when the 0. 05g point was sensed. Thus, the MCP performed an important func- 
tion on unmanned flights as the redundant deceleration indicator. 
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TABLE IV. - NOMINAL MISSION SEQUENCE OF EVENTS FROM ENTRY TO LANDING 


Time 

reference 

Initiated 
by — 

MCP 

function 

Function 

Output 
to — 

Entry phase 

(about 28 min 

G&N 

X 

0. 05g ON « 88 400 m (» 290 000 ft) 

MCP 

before landing) 

MCP 

X 

O.OSg signal (backed up by the MCP 
O.OSg backup function) 

SCS 


MCP 

X 

Earth landing system (ELS) activate A 

ELS 


MCP 

X 

ELS activate B 

ELS 


MESC 


7620-m (25 000 ft) barometric switch armed 

ELS 


MCP 

X 

Switch to negative- Z antenna 

T/C 



7620 

-m (25 000 ft) altitude 



ELS 


7620-m (25 000 ft) barometric switch activated 

MESC 


MESC 


SCS/RCS enable OFF 

RCS 


MESC 


Apex cover jettisoned 

CM 




Drogue-parachute deployment (reefed) 

CM 




Drogue-parachutes disreefed 

CM 





Arm 3658-m (12 000 ft) barometric switch 

ELS 

3658-m (12 000 ft) altitude 

t^ (maximum of 

ELS 

X 

3658-m (12 000 ft) barometric switches A and B 

MCP 

13 min before 
landing) 

MCP 

X 

Start landing backup 14- min timer 

MCP 

t^ + 20 sec 

MCP 

X 

Connect C battery to flight and postlanding 
(F&PL) bus 

EPS 


MCP 

X 

RCS fuel dump activate A 

RCS 


MCP 

X 

RCS fuel dump activate B | 

RCS 


MCP 

X 

Arm landing switch 

MCP 


MCP 

X 

vhf recovery beacon ON 

T/C 


MCP 

X 

vhf survival beacon ON 

T/C 

t^ + 270 sec 

MCP 

X 

RCS purge activate A 

RCS 


MCP 

X 

RCS purge activate B 

RCS 


MCP 

X 

Impact landing 
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Sequencing Postlanding Recovery Aids 

Another function of the MCP was to sequence the postlanding recovery aids for the 
unmanned missions. The correct performance of these functions was necessary to 
ensure the recovery of the spacecraft after landing was successfully achieved. The 
sequence of events after landing (table V) was initiated by the impact of the spacecraft 
on the water. The impact was sensed by triply redundant switch accelerometers in the 
ADS unit of the MCP. The MCP was also required to test and certify the uprighting 
system of the spacecraft before a manned flight. The ADS unit contained triply redun- 
dant attitude indicators that could sense whether the spacecraft was floating apex up 
(stable I) or apex down (stable II). If a stable II signal had been indicated by the attitude 
switches (table V), logic circuits in the SCC would have relayed a signal to the upright- 
ing system to inflate the flotation bags. 


TABLE V.- NOMINAL MISSION RECOVERY SEQUENCE OF EVENTS 
[All events are MCP functions initiated by the MCP.] 


Time 

reference 

Function 

Output 
to — 


Nominal events 



Impact landing 



Main-parachute disconnect A 

ELS 


Main-parachute disconnect B 

ELS 


Arm attitude indicator 

MCP 


Connect entry batteries to F&PL bus 

EPS 


Connect auxiliary batteries 1 and 3 
to F&PL bus 

EPS 


Connect auxiliary batteries 2 and 3 
to F&PL bus 

EPS 

tp + 11 sec 

Remove entry batteries from main buses 

EPS 

Deploy high-frequency (hf) recovery 
antenna (stable I only) 

T/C 


MESC logic bus A safe 

MESC 


MESC logic bus B safe 

MESC 


Flashing light ON 

T/C 


hf transceiver ON (stable I only) 
Circuit breaker 45 OPEN 

T/C 
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TABLE V. - NOMINAL MISSION RECOVERY SEQUENCE OF EVENTS - Concluded 
[All events are MCP functions initiated by the MCP.] 


Time 

reference 

Function 

Output 
to — 

Nominal events - Concluded 


Auxiliary battery 1 OFF 
auxiliary bus A 

EPS 


Auxiliary battery 3 OFF 
auxiliary buses A and B 

EPS 


Auxiliary battery 2 OFF 
auxiliary bus B 

EPS 

tp + 12 sec 

MESC pyrotechnic bus A safe (stable I 
only) 

MESC 


MESC pyrotechnic bus B safe (stable I 
only) 

MESC 

Events for stable I landing 


Flotation pumps OFF 

URS^ 


hf transceiver ON 

T/C 


Deploy hf recovery antenna 

T/C 

tj + 1. 0 sec 

MESC pyrotechnic bus A safe 

MESC 


MESC pyrotechnic bus B safe 

MESC 

Events for stable II landing 

‘o 

hf transceiver OFF 

T/C 

1q + 60 sec 

Flotation pumps ON 

URS 


Flotation bag 1 fill 

URS 

tp + 360 sec 

Flotation bag 1 OFF 

URS 

Flotation bag 2 fill 

URS 

+ 660 sec 

Flotation bag 2 OFF 

URS 


Flotation bag 3 fill 

URS 

tp + 960 sec 

Flotation bag 3 OFF 

URS 


Flotation pump OFF 

URS 


^prighting system. 
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DESIGN USING EXISTING TECHNOLOGY 


The critical development schedules for the MCP required that existing electronic 
technology be used. Components that had been previously qualified on other missile or 
space programs were selected whenever practicable. 


Spacecraft Command Controller 

The MCP block diagram in figure 4 
shows the Apollo system interfaces 
required by the MCP. The SCC unit of the 
MCP provided the logic capability needed 
to accomplish the interface and event- 
sequencing requirements. The event- 
sequencing and switching functions for the 
unmanned flights were accomplished by 
the use of relays. These hermetically 
sealed microminiature general-purpose 
relays, which had an all- welded construc- 
tion, were used extensively in the logic 
and switching circuitry. The relays 
operated at 28 V dc and had a 2-, 3-, or 
10- ampere current rating. 

The redundancy requirements of the 
MCP were classified into four categories. 

1. Simplex (not redundant) — The 
MCP output or real- time- command func- 
tion may fail either ON or OFF because of 
a single MCP component failure 
(fig. 8(a)). 


28 Vdc 

Input 



Output 


(a) 


Simplex (not redundant). 


ZSVdc 
Input 


6 


Output 



(b) Dual series (redundant). 



(c) Dual parallel (redundant). 


2. Dual series (redundant) — The 
MCP output or real- time- command func- 
tion shall not fail ON as a result of any 
single MCP component failure (fig. 8(b)). 

3. Dual parallel (redundant) — The 
MCP output or real- time- command func- 
tion shall not fail OFF as a result of any 
single MCP component failure (fig. 8(c)). 

4. Dual series, triply parallel 
(redundant) — The MCP ou^ut or real- 
time- command function must respond cor- 
rectly in the event of a single MCP 
r.nirmnr»pr»t failure ffip". 

_j- ^ ^ ^ , . 



Relay B 


(d) Dual series, triply parallel (redundant). 
Figure 8.- Circuit logic and switching relays. 
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The redundancy requirements for the MCP design were established by using these 
four categories. A request for a definition of the requirements of the system interface 
was submitted to the appropriate engineering design groups, and specific redundancy 
requirements were obtained on an event- by- event basis for numerous potential mis- 
sions. The design of the MCP was then established consistent with these mission 
redundancy requirements. 

The redundancy options that were used in the MCP are shown in figure 8. Exam- 
ples of equivalent redundancy could also be illustrated within the MCP, showing the use 
of time delays, capacitors, diodes, et cetera. The relays are used for illustration 
because they represent the majority of the components in the MCP. 

The circuits in figure 8 are shown with relay contacts configured in the normally 
open state. Similar redundant configurations are used with the relay contacts in a 
normally closed state. Both momentary and latching relays were used in the MCP 
design. Momentary relays remain switched into the changed- state configuration only 
as long as the switching signal is applied to the solenoid. Latching relays remain in 
the switched configuration until an additional reset switching signal is applied to the 
reset solenoid of the relay. 

A triply redundant grounding network was used throughout the cable- harness and 
panel- harness assemblies (fig. 9) to provide electrical grounds for the MCP. This 
grounding scheme was important in accomplishing the bench tests and spacecraft tests 
that verified the redundant components within the MCP. During tests, these grounds 
(Gi, G 2 , and Gg) were alternately cycled (opened and closed) or cycled in combinations 

(GjGg, GgGg, Or Gj^Gg) to isolate and verify the operation of specific redundant paths. 

For example, in figure 8(d), assume relay A operates with ground G^; relay B with 

ground Gg; and relay C with ground Gg. The redundant paths would be verified as 

follows. 

1. Make contact between grounds G^^ and Gg, and leave Gg open. 

2. With the proper signal to the relay solenoids, relays A and B close their 
contacts. 

3. Step 2 verifies the center path shown in figure 8(d). The top and bottom cir- 
cuits remain open because relay C has no ground to complete its circuit and does not 
close. 

4. Make contact between grounds Gg and Gg, and leave Gj^ open. 

5. Relays B and C close their contacts, and relay A remains open. 

6. Step 5 verifies the bottom path shown on figure 8(d). The two top paths remain 
open because relay A has no electrical ground to activate its solenoid circuits and the 
contacts do not close. 

7. Relay A in the middle path does not have its contacts failed in a closed position 
in step 3, because in step 6 the middle path opened. If, in step 6, the middle row of con- 
tacts had not opened, the failure of relay A in a closed position would have been indicated. 
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Figure 9.- Cable assembly wire harness. 


This method can be continued until each redundant function is verified. This 
redundancy was an important part of the Apollo Program, because the proper function- 
ing of each redundant circuit path had to be verified just before the spacecraft was 
launched. The procedure of checking redundant circuitry before launch was used for 
the Mercury spacecraft and was continued for the Apollo spacecraft. In general, this 
verification of redundant circuit paths was a simple task for the Apollo spacecraft, 
because most systems were designed to be dually redundant (system A and system B). 
The power could be removed from either system to verify the proper functioning of the 
companion system. However, checking the redundant circuitry in the MCP became a 
difficult and tedious job because of the many complex series-parallel circuit paths. 

As shown in figure 2, the SCC used 19 printed wiring boards (control assemblies). 
The detailed logic circuits, relays, time-delay circuits, and other components were 
plugged into these control assemblies; the components of this circuitry were standard- 
ized and interchangeable. For example, a 3- ampere latching relay could be inter- 
changed with a 3-ampere momentary relay, or a 15-second time-delay device could be 
interchanged with a 60-second time-delay device (figs. 10 and 11). Great care had to 
be taken by the manufacturing personnel when removing a component that had previously 
been mounted and soldered to the printed wiring board; otherwise, the metallic track 
could be lifted from the board or damaged. The control assemblies used for the vari- 
ous MCP systems were also standardized and interchangeable. For example, control 
assembly 6 in MCP system 2 and the similar control assembly in MCP system 4 could 
be interchanged to resolve a problem with solder closeout relays. 

The SCC had 15 connectors to meet the various interface requirements and to 
provide sufficient test points for ground tests. The unit had a ground- shorting connec- 
tor and three GSE connectors that were instrumented for the box-level bench tests. 

The internal grounds could be automatically applied and removed while the operation of 
various components was being verified on the bench test console. 


25 



Figure 10. - Printed wiring board with components. 


The importance of design flexibility must be emphasized. A description has been 
given of the increased flexibility obtained by interfacing the MCP with the G&N system 
for its input keying commands rather than by using fixed preset timers. However, this 
increased flexibility was limited. The interface connectors of the G&N system, the 
S-IVB lU, and the launch control and GSE (figs. 5 to 7 and 12) provided the MCP with 
capabilities for 15 different flight keying and sequencing commands, which could be 
modified for each mission, and 12 prelaunch keying commands. For approximately 
120 different mission events, the MCP furnished the logic circuitry and internal time 
delays for switching the output to the interfacing systems at the correct mission times. 
The capabilities of the hardwired logic circuitry were not as flexible as had been desired. 
As mentioned previously, changes in the mission event sequence on-off times of inter- 
facing hardware sometimes resulted in major MCP design changes. 

The following are examples of MCP design changes resulting from changes in 
mission plans or in interfacing system requirements, 

1. The planned trajectories for the Apollo 4 mission indicated a possibility of 
spacecraft skipout during the entry phase. The MCP originally had latching relays to 
prevent the loss of the 0.05g signal once it was obtained. During the Apollo 4 mission, 
the 0.05g signal could be obtained, lost during skipout, and then obtained again; there- 
fore, the latching relay had to be replaced with a momentary relay. 
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Figure 11.- Bracket showing relays and time-display mountings. 


2. A 14-minute time delay was required after a sensing function (indicating an 
equivalent barometric pressure at a 3658-meter (12 000 foot) altitude) was added to the 
MCP. This function was an ELS backup to initiate cutting of the parachute shrouds 5 to 
10 minutes after landing. 

3. The gimbal motor on-off times were changed from mission to mission to pre- 
vent the actuator clutches from overheating. 

4. A time delay was added in the MCP to prevent damage to the high-frequency 
antenna by not allowing the antenna to deploy before the spacecraft was in an apex-up 
attitude in the water. 

5. Before the mission, the SPS engine gimbal positions were predicted for each 
firing during the mission. These positions were preset in the MCP to prevent large 
gimbal position changes and large transients during the firing initialization. Each space- 
craft had different center- of- gravity requirements at the various firing times; thus, 
each spacecraft required different gimbal position settings that necessitated modification 
of the MCP system. 
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New interface 


C6A1J13 

Ground command G-1 
controller dc negative 


Ground command G-2 
controller dc negative 


Ground command G-3 
controller dc negative 


i Existing c 
j MCPtest 
/ connectors 

'C6a£T8 

Spacecraft command g- 1 
controller dc negative 


Spacecraft command G-2 
controller dc negative 


Spacecraft command g- 3 
controller dc negative 
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Figure 12. - Automatic checkout equipment 
interface requirements for the MCP 
redundancy test. 


6. On-off sequences for the tape re- 
corders and cameras were changed for each 
mission. 

These few examples of the hardware changes 
made to the MCP indicate the flexibility 
required of a developmental flight system 
such as the MCP. For example, before the 
design of the MCP was complete, preplan- 
ning should have determined that the gimbal 
position settings would vary from mission to 
mission and that the hardware should be 
designed so that a technician could change 
the settings without opening the SCC. When- 
ever this unit was opened, a complete reac- 
ceptance test was required. In future 
programs, the changeable characteristics 
of unmanned developmental flight tests 
should be recognized, and various flexible 
software methods of programing mission 
changes should be considered. 


Ground Command Controller 

The GCC unit of the MCP interfaced primarily with the updata link. This unit 
provided the switching- logic circuitry, the relays, the relay drivers, and other com- 
ponents for processing the 77 real-time ground- command signals originating at the flight 
control consoles in the Mission Control Center. The GCC design did not require the 
degree of flexibility required by the SCC. During the program, GCC changes were made 
to correct design problems and to eliminate certain capabilities, rather than to revise 
and redesign logic and interface circuitry. As previously discussed, five real-time 
commands were eliminated from the Apollo 4 and 6 missions; the GCC wiring associated 
with these commands was cut and stowed. 

The GCC used component and wiring redundancy similar to that previously de- 
scribed for the SCC. The series- redundant circuitry (fig. 8) was the most commonly 
used circuit logic; however, parallel- redundant circuitry was used for processing the 
reset real-time command, and series-parallel- redundant circuitry was used for proc- 
essing the abort command. 

The GCC was designed to respond to minimum current inputs of 18 to 24 milli- 
amperes with a pulse duration of 25 to 35 milliseconds from the updata link. Also, the 
unit was designed not to respond to current levels less than or equal to 28 milliamperes 
when pulse durations were less than or equal to 1 millisecond. Early electromagnetic 
interference (emi) tests at the factory showed that the GCC relay drivers were trigger- 
ing on noise voltages, and resistor- capacitor filter networks had to be added to each 
relay driver. This design change was the most significant factor incorporated in the 
GCC. The general configuration of the GCC and the SCC is the same (fig. 2). 
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The reset real-time commands 05, 13, 23, 43, 50, 60, and 70 were necessary 
because, once the GCC relay driver received a minimum- value current pulse from the 
updata link, the associated latching relays were activated. The real-time command 
could be removed or canceled only by sending a reset command. Some real-time com- 
mands used momentary relays (e. g. , positive- Z antenna ON). These momentary 
relays were on as long as the command was being transmitted and off at all other times. 
The use of latching relays saved the electrical power that would have been required to 
hold the relay solenoid in the activated state and amounted to considerable power savings 
for events that would be on for long periods. 


Attitude and Deceleration Sensor 

The ADS unit of the MCP performed the critical spacecraft recovery requirements 
during the entry, landing, and recovery phases of the mission. The ADS design (fig. 3) 
was simple, consisting of the following major components. 

1. Three spring- mass impact switches (accelerometers) to sense the water 
impact during landing 

2. Three pendulum- mass attitude indicators to sense stable I or stable II orienta- 
tion of the spacecraft after landing 

3. Two linear accelerometers to sense the 0. 05g level during entry 

4. A pivot shaft and pivot frame for ground test of the attitude indicators 

5. Push- to- test switches for ground testing the 0. 05g and landing accelerometers 

6. A radio-frequency interference filter for the input power 

Components of the ADS were used in the following order during a mission. 

1. The 0. 05g accelerometers were armed by a signal from the SCC at the time of 
CM and SM separation. These accelerometers were designed to trigger at decelerations 
of 0. Ig to 0. 5g, a higher deceleration value than the 0. 05g value furnished by the G&N 
system. In June 1966, the 0. 4g spread in the tolerance of the backup deceleration sen- 
sor was recognized as possibly causing a wide deviation between the actual and planned 
spacecraft landing points when the backup signal was used. A specific test was then 
added to the box-level acceptance test to measure and record the exact deceleration 
level of this sensor. For spacecraft 017, this deceleration value was 0. 29g ± 0. 04g for 
initiating the backup 0. 05g signal. The 0.05g signal would be automatically overridden 
by the ADS in case of a skipout trajectory. The ±0. 04g tolerance could not be discarded 
because the accelerometers were temperature sensitive and the precise flight tempera- 
tures were not defined. The trigger point was better defined, however, at an order of 
magnitude closer than the initial values. 

2. The three impact switches were armed by a signal relayed from the SCC when 
it sensed an altitude of 3658 meters (12 000 feet). The impact switches were designed 
not to trigger for impact pulses less than 4. 7g and to trigger for values of approximately 
5g and above. A push-to-test switch was provided for each impact switch for ground- 
test purposes. 
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3. The three attitude sensors were armed by the impact deceleration pulse. 

These sensors indicated stable I whenever the apex of the spacecraft was approximately 
±65° from an upright position. When the apex of the spacecraft dropped below the 
65° point, stable II was indicated by the sensors. Additional stable II functions of the 
sensors are given in table V. These attitude sensors could be tested in the spacecraft 
by loosening a hexagonal nut (fig. 3) and pivoting the sensors to effect a change in atti- 
tude signal. 


TEST EQUIPMENT DESIGN 


To meet the critical schedule requirements for the MCP qualification program 
and delivery, the contractor built three types of test equipment. 

1. Manufacturing test sets 

2. Manual test equipment (MTE) 

3. Factory test equipment (FTE) 

The manufacturing test sets were essential in the test activity associated with the pro- 
duction and assembly of the MCP control assemblies and printed wire networks. These 
test sets performed satisfactorily and supported the program in a timely manner. 

The manual bench test console verified the operational status of each redundant 
component in the MCP during acceptance tests and other box- level tests. This bench 
console required that the input signal be switched manually at the times required by the 
test specifications. Groups of test points (e. g. , 60 test points) were collectively mon- 
itored and, if no anomaly occurred, that test zone of redundant elements within the MCP 
was considered satisfactory. This MTE was similar to the equipment developed for the 
control programer in spacecraft 009 (AS- 201 mission) and was completed on Novem- 
ber 14, 1965, in time to support the initial breadboard and early MCP protot 5 q)e 
deliveries. 

The MTE required approximately three times as long to complete a test run as 
did the automatic FTE; however, the MTE was sufficiently simple that the equipment 
could be certified and debugged in a timely manner and could be reconfigured for com- 
patibility with changes in the flight hardware. 

The automatic FTE was used for the postenvironmental functional tests and the 
MCP systems tests. This test equipment included the following. 

1. A punched-tape reader to provide the input stimuli with the associated power 
supplies and signal- conditioning equipment 

2. A series of internal logic circuits to control the switching and route the sig- 
nals to the correct MCP area 
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3. A master clock to control the timing of the input signals and to provide a time 
comparison of the MCP response 

4. An output load simulator to simulate interfacing systems loads 

5. A printer to provide a tape record of the test events 

The automatic FTE was primarily used to support qualification testing. A series 
of test tapes was prepared to support the environmental and postenvironmental func- 
tional tests as follows. 

1. Environmental functional tests 

a. Abbreviated- time simulated mission 

b. Real-time simulated mission 

c. Simulated abort and entry test 

2. Postenvironmental functional tests 

a. see functional test 

b. Gee functional test 

The requirement existed to automate the test and sequencing of the MeP while it 
was operating in the qualification- test environment. For example, during the vacuum 
test, an abbreviated- time simulated mission was performed while the MCP was in the 
4-hour soak period of the vacuum environment. This requirement would have been 
impossible to achieve with the MTE because 48 hours would be required to sequence the 
MCP through all the programer functions manually. As a result, the requirement for a 
4- hour vacuum soak would have to be exceeded. However, if the 4- hour vacuum soak 
were retained, the number of functions that could be manually sequenced would be so 
limited that only a small part of the MCP internal logic circuits could be tested. 

The development and certification of the elaborate and complex FTE within the 
allotted schedule period caused considerable difficulty. A 4- month delay in the start 
of qualification of the GCC and SCC was generally attributed to problems in certifying 
the test equipment, the test specifications, and the test tapes. The schedule problem 
concerning certification of the FTE was related to the original design concept and the 
planned method of test. Considering the critical development schedules and the small 
number of unmanned systems to be delivered, the test equipment concept was much too 
complex and automation was overly emphasized. 

Some specific problem areas in certifying the FTE included the following. 

1. The test equipment did not verify functional paths within the MCP but checked 
out zones or groups of components; therefore, when a hardware change was incorporated 
in the MCP, a compatible change was difficult to incorporate in the related component 
group of the test equipment. Hardware changes also caused difficulty in updating the 
test specifications. 
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2. The tape reader had no reliable method of performing an internal verification 
or self- check. If a part of the tape message was missed, it was difficult to determine 
whether the problem was in the reader, the test equipment, the MCP, or some other 
system or component. 

3. A reliable method was not developed to revise only specific sections of the 
test tapes to reflect hardware modifications. A reprograming effort involving the entire 
test sequence seemed to be required. The test tape could not be cut and spliced; there- 
fore, a new tape had to be generated to include the updated test section. As a result, 
the manpower requirements for test equipment programing were increased whenever 
the flight hardware was changed. 

Because of these test equipment reprograming delays, the FTE was not used to 
any great extent in supporting the MCP reacceptance tests following design modifica- 
tions. The MCP redundancy test performed in the spacecraft provided a sufficient 
confidence level, and a systems- level functional acceptance test at the vendor was not 
required. The FTE was not reprogramed and reconfigured to reflect the numerous 
MCP hardware changes. The engineering time was more efficiently used in actually 
performing the vendor box- level acceptance tests on the slower MTE than in preparing 
the automatic FTE to perform the MCP system- level test. 

This experience could well be applied to the development of test equipment for 
future programs that have small quantities of deliverable end-items. For this type 
program, it seems preferable to expend the necessary engineering manpower in devel- 
oping simple, flexible, manual, general-purpose test equipment and then to make the 
necessary allowances in delivery schedules. This approach appears preferable to 
expending the manpower in developing automated, complex, inflexible test equipment 
that would perform the test faster. 


DEVELOPMENT SCHEDULES AND TEST PROGRAM 


On June 25, 1964, the Apollo prime contractor was notified to develop a programer 
with the capability to conduct the unmanned missions AS- 201, AS- 202, AS- 501, and 
AS- 502. The original schedule for the MCP installation into spacecraft Oil at the con- 
tractor's facility was January 13, 1966. The MCP development team had 19 months to 
design, build, test, and deliver the first flight system. The following paragraphs 
describe the most significant milestones concerning this development. 
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Breadboard and Prototype Development 

The following schedule was achieved and indicates the compressed and critical 
nature of delivery milestones for the MCP. 


Delivery milestone 


Date 


Design configuration freeze 
Breadboard system delivery 
First protot 3 ?pe unit delivery 
Second prototype unit delivery 
First production unit delivery 


October 28, 1965 
November 1965 
December 3, 1965 
December 17, 1965 
January 14, 1966 


Although the design configuration freeze was dated October 28, the following sig- 
nificant changes to the MCP design were approved on November 8; therefore, the 
configuration was not really frozen. 


1. The on and off times of the flight- qualification tape recorders were changed 
and required wiring changes in the MCP. 


2. The very-high-frequency antenna was switched differently for spacecraft 017 
and 020, and additional wiring changes were required. 

A maximum of 1 month was scheduled between delivery of the breadboard and the 
first prototype. The term "breadboard" cannot be used in the sense that the breadboard 
was a device to be tested and evaluated, with the results of the evaluations being fed 
back as design improvements. The rigorous acceptance tests and inspection- approval 
criteria that normally constrain development did not apply to this breadboard unit; 
therefore, the manufacturer could produce the unit as a working device to help in the 
test equipment development and certification. The prototype unit used the same produc- 
tion manufacturing and assembly techniques as the flight units. The first protot 3 qje was 
delivered to the spacecraft contractor for simulation testing and interface verification 
testing. The combined systems tests and simulations, using the first prototype unit, 
uncovered the problem of the MCP relay drivers triggering on noise. These evaluation 
tests were also valuable in establishing a redundancy checkout scheme for the MCP 
while it was installed in the spacecraft. 

The second prototype was used as a prequalification test article for certifying 
both the MTE and the FTE before the official start of the qualification program. Suffi- 
cient time was not available for the breadboard- and prototype-development programs 
to provide useful information for the flight system design without a significant cost and 
schedule impact. Ideally, 6 months should be scheduled between the breadboard and 
first production item delivery dates for hardware as complex as the MCP. 


Electromagnetic- Interference Considerations 

While evaluating the first MCP protot 3 q)e in the communications laboratory, the 
spacecraft contractor discovered that the GCC relay drivers were triggering on noise 
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voltages. At the beginning of the Apollo Program, one MCP unit was scheduled for 
environmental qualification tests and another unit for emi qualification tests. The emi 
test and success values were difficult to establish on a black-box level because the 
interference is an interrelated- systems problem. Therefore, the requirement for emi 
qualification tests on the black-box level was eliminated before the MCP qualification 
tests were scheduled. An overall emi test scheme was to be established on the 
spacecraft- test level. 


Test Equipment Certification 

The following schedule was achieved concerning certification of the FTE. 

Item Date 


FTE test tape development start 

MTE completion 

FTE test tape completion 

MTE recalibration 

FTE test tape certification 

FTE certification 


October 28, 1965 
November 14, 1965 
March 7, 1966 
March 11, 1966 
April 6, 1966 
April 8, 1966 


Certification of the FTE was important in that this certification was a constraint 
to the start of the systems test portion of the MCP qualification program. The FTE 
certification, or development testing, could not begin without an MCP test article to 
process the responses to the test input signals. The MCP breadboard system, delivered 
in November 1965, was used in this development. This late delivery allowed only 
6 months for development and certification testing of the FTE. This length of time 
was extremely short for testing, debugging, and certifying a test equipment system of 
this complexity. However, the original schedules allowed only a 2- month period from 
breadboard delivery to certification completion and qualification test start. This 
period was not sufficient to achieve the test equipment certification; therefore, the quali- 
fication start date was extended by 4 months. 


The certification of the test equipment was achieved by using a production proto- 
type MCP unit that was essentially identical to the qualification unit to be tested later. 
First, an acceptance test using manual test methods was performed on the prototype, 
and each redundant function was verified to be operating. This unit was then used as a 
test equipment certification unit, and the same test specifications were used. If every 
test function was processed through the certification unit and was recorded by the FTE 
with no anomalies, the test function was certified. If an anomaly occurred, then an 
analysis had to be performed to determine whether the test equipment or the certifica- 
tion unit had malfunctioned. This step- by- step method was demanding and time con- 
suming, but the FTE was finally certified. 
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Production Delivery 

The following schedule was achieved for the MCP production unit deliveries and 
modifications. 


Production delivery 


Date 


Unit 1 
Unit 2 
Unit 3 

Completion of design modifications to unit 1 after 
completion of contractor tests 

Unit 4 

Modification of unit 3 to spacecraft 017 configuration 
Unit 5 
Unit 6 

Modification of unit 4 to spacecraft 01 7 configuration 


January 14, 1966 
March 30, 1966 
April 5, 1966 
May 1966 

June 11, 1966 
July 14, 1966 
August 19, 1966 
September 16, 1966 
October 3, 1966 


Of the six production units delivered, units 1, 3, and 4 required several design 
modifications to make them compatible with the MCP design configuration for space- 
craft 017 and 020. The design changes were incorporated in production units 5 and 6 
before delivery. The qualification unit 2 did not require modification because the design 
modifications did not require requalification testing. The MCP supported the spacecraft 
delivery and test schedule dates; however, some of the design changes and rework had 
to be accomplished during the idle vehicle test periods. For example, the rework was 
started after the MCP finished supporting the integrated systems test at the spacecraft 
contractor's facility and was completed before the next requirement to support tests in 
the vehicle at the NASA John F. Kennedy Space Center (KSC). Ideally, the spacecraft 
connectors would not have been disturbed, and the MCP would have been delivered to 
the KSC while installed in the spacecraft. 


Qualification Tests 


The following key schedule dates describe the qualification test program. 


Item 


Date 


Original qualification test start 
Actual qualification test start 
MTE certification 

Qualification production unit 2 delivery 
Qualification production unit 3 delivery 
FTE certification 


December 17, 1965 
February 17, 1966 
March 11, 1966 
March 30, 1966 
April 5, 1966 
April 8, 1966 
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Item 


Date 


Qualification test completion April 23, 1966 

Qualification report release May 31, 1966 

The original qualification test start date is listed to emphasize the importance of 
allowing adequate time to certify and evaluate test equipment. This original start date 
of December 17, 1965, was postponed 4 months for the GCC and SCC units because of 
previously mentioned problems with test equipment certification. The actual qualifica- 
tion program was able to be begun as early as February only because the qualification 
testing of the ADS unit was started before the GCC and SCC units. The FTE was not 
required for the postenvironmental tests of the ADS unit. The FTE was finally certified 
April 8, 1966, and was available for use during the MCP system-level functional tests 
for postenvironmental evaluations. These system tests of the MCP were programed on 
punched tape, and the test equipment automatically generated, switched, and routed the 
stimulus and response signals; measured the time of response; and evaluated the logic 
state of the circuitry being tested. 

A detailed schedule of the qualification testing sequence is shown in figure 13. 
Items 1 to 15 in figure 13 represent keywords for coding the test activity during any 
specific test period. For example, from March 10 to March 15, during the qualification 
test of system 2, the activity was 15 (MTE functional tests). As the test results are 
discussed in the following paragraphs, the test sequence can be established by referring 
to figure 13. 


Qualification testing, 
system 1 

Ground command controller 
and spacecraft command 
controller 

Qualification testing, 
system 2 

Spacecraft command 
controller 
Ground command 
controller 

Attitude and 
deceleration sensor 


1. Vacuum 

2. Oxidation 

3. Humidity 

4. Resistance 

5. Random vibration 

6. High temperature 


8. Acceleration 

9. Factory test equipment test 

10. Manufacturing rework 

11. Manual test equipment test and specification certification 

12. Factory test equipment test and specification certification 

13. Life test vibration 


7. Shock 

14. Real-time mission simulated mission 

15. Manual test equipment tests functional 
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Figure 13. - Qualification testing sequence. 


The ADS package of MCP production unit 2 was subjected to the qualification test 
environments. Because of the simple design of this sensor package, all the environ- 
mental tests, except shock, were completed in 1 week. Because this package also had 
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to support the life test, the shock environmental test was postponed until the end of 
qualification testing. The sensor package successfully completed the qualification tests 
with no anomalies, no visible physical damage, and no operational degradation.. 

The MCP production unit 2 (qualification test unit 2) was initially ready to begin 
qualification testing on February 26, 1966. However, the FTE either had not been 
completed or was not certified. Because of the critical schedule requirements, the 
qualification tests were started, using only a few manually initiated commands for each 
postenvironmental verification of the MCP. No failures were detected during the initial 
vacuum, oxidation, or humidity testing. 

After the humidity test, the qualification test packages were to be given a complete 
package functional test, using the MTE. This equipment had been used earlier to com- 
plete the testing of qualification unit 2, but the new test specifications required box- level 
testing of redundant circuitry. These specifications had not been checked out against 
any package or with the MTE. When the postenvironmental (vacuum, oxidation, and 
humidity) testing was attempted, numerous problems were encountered and too many 
unknowns (such as MTE, test specifications, and MCP) were involved. As a result, the 
period between March 2 and April 2, 1966, was used to debug and certify the specifica- 
tions and the MTE, to retest the MCP, and to check out the functional test tapes for the 
FTE. During this period, failures were detected in the packages; some failures were 
due to manufacturing errors not previously tested in the redundant circuits during sell- 
off; others were induced by the MTE. These failures reemphasized the critical require- 
ment of entering a qualification test program with a good baseline; that is, with certified 
test equipment, verified procedures, and adequate specifications. 

After qualification unit 2 finished serving as a test article for the certification of 
the automatic FTE, the test equipment was successfully used to complete a functional 
test on qualification unit 2. The unit then entered the life test sequence on April 2, 1966. 
The purpose of this test was to verify that the MCP could perform normal mission 
functions after accumulating more than 500 hours of operating time. After the required 
number of operating hours was accrued, the MCP entered the real-time simulated 
mission run on April 15, 1966. The MCP proved to be capable of performing the func- 
tion of a real-time mission after being subjected to random vibration levels and accruing 
more than 500 hours of operating time. 

The MCP production unit 3 (qualification test unit 1) entered the vibration environ- 
ment portion of the qualification test on April 2, 1966. The vibration effects to be 
investigated were the resonances of each package (resonance search) and the suscepti- 
bility of the MCP to random vibration. The postvibration physical inspection of the MCP 
indicated 35 instances of fractured solder joints on the pins of the SCC control assembly 
connector boards (fig. 14). The GCC had 10 loose or broken solder joints around 
similar pins. However, no functional test failures were attributed to the solder frac- 
tures around the pins. The corrective action for the cracked- solder- joint problem 
included soldering the terminals on both sides of the circuit strip (fig. 15) and adding 
a bracket to improve the wire- bundle routing. The corrective action was successful, 
and the problem did not recur during future vibration tests. 
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(a) Orientation of rework area. 


(b) Closeup of rework area. 


Figure 15. - Repair method, soldering backside of terminal strip. 


The second significant problem was detected during the humidity and posthumidity 
functional test portions of the qualification program. The reverse impedance of the 
MCP diode quads was below the specification limits after the 16-hour humidity test. 
These impedances were within the specified value (greater than 700 kilohms) after about 
1 hour of drying. The diodes in the SCC were affected after being exposed to 
95 ± 5 percent relative humidity; but, for normal unmanned flight, humidity was not 
expected to be a problem. The corrective action was to provide added protection by 
applying polyurethane (polycoat) to the control assemblies containing the diode quads 
(fig. 16). On April 22, 1966, after the polyurethane was applied to the control assem- 
blies in qualification unit 2, the unit was retested in the humidity environment and 
satisfactorily met the specifications. The qualification tests were completed on 
April 23, 1966, and the test report was released on May 31, 1966. 


Interface Verification Tests 

The interface verification tests performed in the various engineering laboratories 
at the spacecraft contractor’s facility provided much useful data. Some of the most 
significant results were as follows. 

1. Identification of the relay driver emi problem in the GCC 

2. Establishment of the concept of onboard redundancy tests for the MCP 

3. Verification of the allowable SPS gimbal position mistrim parameters 

4. Verification of the new design modifications before actual installation 
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5. Identification of the system interface incompatibilities 

6. Provision of useful information for resolving spacecraft test anomalies 





Figure 16.- Tjrpical diode mounting bracket. 


The MCP prototype unit 1 was delivered to the spacecraft contractor on Decem- 
ber 3, 1965. This unit was first checked to verify electrical interface and compatibility 
with the spacecraft electrical power system. Unit 1 was then subjected to several 
different interface tests with individual spacecraft systems, such as the communications 
system and the MESC. Finally, the MCP prototype was tested, along with several 
other systems, in the guidance and control laboratory during the combined systems 
dynamic verification tests. The combined systems-test setup and the use of toggle 
switches to switch the internal grounds (G^, G 2 , and Gg) of the MCP suggested a method 

for testing redundancy of the MCP while in the spacecraft. 
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Spacecraft Tests 


The MCP was installed in the spacecraft before the combined and integrated sys- 
tems tests were started at the spacecraft contractor's facility. The MCP served as the 
interfacing unit between the G&N system and other input stimulus sources and the space- 
craft flight systems that actually activated and performed the desired spacecraft output 
functions during the ground tests and also during flight. The MCP had no flight or 
spacecraft test measurement allocation, even though it had 10 connectors with over 
500 measurement pins readily available for bench tests at the factory. The rationale 
for having no MCP flight measurements nor ground test measurements was that the un- 
manned vehicles would be instrumented and tested the same as the manned vehicles. 
Therefore, the functional operation of the MCP was determined by observing the func- 
tional operation of the related output systems that were instrumented. This rationale 
would have been adequate if the MCP processed programer signals through single func- 
tional paths. However, the MCP contained numerous series- redundant and parallel- 
redundant paths (as previously described). 


The Apollo Program had a requirement that each redundant path be verified as 
functioning properly just before launch. This requirement was interpreted to mean that 
the MCP, even though it was for unmanned flights, had to have its redundant paths veri- 
fied in the spacecraft just before launch. The following schedule indicates the time 
required to implement the MCP redundancy tests. 

Event Date 


NASA directed the contractor to accomplish space- 
craft redundancy tests. 

NASA management met with the contractor to 

resolve details concerning spacecraft redundancy 
checkout requirements. 

Contractor requested 78 automatic checkout equip- 
ment measurements for fault isolation of the MCP. 

Measurement requirement request was denied. 

NASA review determined that no plan was available 
for installed MCP redundancy test. 

MCP spacecraft redundancy test plan was initiated. 

Decision Avas made not to verify the MCP redundancy 
with acceptance checkout equipment. 

The contractor processed an internal procedure to 
verify MCP redundancy. 

An NASA management official directive emphasized 
requirement to perform MCP redundancy at the 
KSC for spacecraft Oil, 017, and 020, and at the 
contractor' s facility for spacecraft 017, and 020. 

The first MCP redundancy test was performed at 

fViCi TTQO ro-t crvo niin y*of+ 1 


March 25, 1965 
April 1965 

April 20, 1965 

October 1, 1965 
November 1965 

December 1965 
February 3, 1966 

April 21, 1966 

June 9, 1966 


July 14, 1966 
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During the 1-year period between the original directive and the final processing of 
procedures for performing this test, the contractor maintained that the MCP redundancy 
tests would not be advantageous for the following reasons. 

1. A 50- man- month effort in programing cost for acceptance checkout equipment 
could be saved. 

2. A saving of 120 hours of spacecraft test time would result, compared with the 
12 hours required for bench test equipment. 

3. Interface equipment for the acceptance checkout equipment would have to be 
designed, fabricated, and certified. 

4. The acceptance- checkout- equipment memory would be saturated. 

Each reason had to be investigated and the problems resolved. Constant management 
pressure and insistence finally resulted in the performance of the MCP redundancy test 
for spacecraft Oil on July 14, 1966. 

For the spacecraft Oil MCP redundancy test at the KSC, a special breakout box 
was designed to interface with the MCP ground- shorting connector. By using jumper 
wires on the breakout box, the test team could cycle the internal grounds (G^^, Gg, and 

G„) of the MCP. Figure 12 shows the MCP/acceptance checkout equipment interface 

for the spacecraft 017 and 020 redundancy test; acceptance- checkout- equipment relays 
were furnished and automatically sequenced to cycle the grounds. The jumper wires 
that were opened and closed manually for spacecraft 011 served the same purpose as the 
acceptance- checkout- equipment relays but required more test time. The test actually 
consisted of three abbreviated mission- time- line test sequences with the required space- 
craft systems powered up; the normal prelaunch countdown was performed but was 
stopped just before lift-off. One run through the abbreviated mission sequence of events 
was made with the appropriate opening and closing of internal ground G^. Two similar 

runs were then made with internal grounds G 2 and Gg being cycled open and closed. 

These runs were to verify that the redundant paths of the MCP were operative while the 
unit was in the spacecraft. These redundancy tests were performed at the KSC for 
spacecraft 011, 017, and 020; also at the contractor's facility for spacecraft 017 and 
020 just before the integrated test. 

The redundancy tests revealed several malfunctions when the MCP was performing 
the function correctly, but a part of the redundancy capability was inoperative. During 
the spacecraft Oil test, two of the redundant time delays were inoperative. When these 
failures were detected, the spare MCP was installed and all the interfaces were reveri- 
fied. (Refer to the section on time-delay failures for these failure analyses.) 
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HARDWARE PROBLEMS AND RESOLUTIONS 


Reliability and Quality Objectives 

In achieving the reliability established for the Apollo Program, a multitude of 
interwoven tasks was required. 

1. Establishing a high-quality component qualification and screening program 

2. Providing a lot traceability at the supplier and user levels for these qualified, 
high- reliability components 

3. Establishing precise, uniform manufacturing techniques in a clean, controlled 
environment 

4. Testing the assemblies at numerous points and stages of production 

5. Qualifying the systems (after manufacturing completion) to the expected 
Apollo environments 

6. Performing numerous system interface tests and simulation studies 

7. Performing detailed spacecraft tests for each interface and mission phase 

8. Analyzing and documenting each failure or anomaly that occurred during the 
program to determine the specific cause of the failure, to provide an acceptable correc- 
tive action, and to prevent future occurrence of the failure 


Relay Failures 

Each MCP system used approximately 1050 relays to establish redundant switch- 
ing logic. These hermetically sealed, microminiature armature relays were developed 
in accordance with the product specifications and end- items specifications of the vendor 
and had a single qualified source of supply. The reliability objective in the relay pro- 
curement was the attainment of a life- failure- rate level of 0. 08 percent in 10 000 relay 
operations with a 90-percent confidence level and a maintained life- expectancy confi- 
dence level of 60 percent per 100 000 operations at 303 K (85° F) under the specified 
rated loads. As shown in table VI, when a proper test and screening program is 
established, the majority of the relay failures occurs before installation of the system 
in the spacecraft. The last two columns of table VI are not exact because the same 
MCP unit was flown on both spacecraft 017 and spacecraft 020 and, because the MCP 
was not tested after the flight of spacecraft 020, relay failures could not be determined 
to have existed. Some of the relay failures at the system- and spacecraft- test level 
resulted from operator errors and were secondary- type failures caused by overcurrent 
applications or short circuits in the associated spacecraft wiring. 
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TABLE VI.- RELAY FAILURE HISTORY 


Relays 

Manufacturer tests 

Vendor tests 

Spacecraft 

contractor 

tests 

KSC 

tests 

Flight 

tests 

Screen 

Life 

Qualification 

Production 

Qualification 

Total failed 

220 

6 

4 

11 

2 

5 

2 

2 

Total tested 

10 000 

300 

300 

6000 

2000 

3000 

3000 

3000 

Failure, percent . . . 

2.2 

2.0 

1.3 

.18 

.1 

.17 

.07 

.07 


Solder Contamination in AACP Relays 

The 9 riginal end- item specification for hermetically sealed microminiature relays 
required that the evacuation and gas-filling hole in the relay case be sealed by using a 
fluxless solder process. The relay had to be cleaned ultrasonically, handled in a clean 
room, and inspected for contamination with a 10-power- minimum magnification unit 
during assembly and before sealing. 

Two relays were found to be inoperative during the spacecraft Oil postflight analy- 
sis in September 1966. The subsequent failure analysis revealed solder- contamination 
particles that caused a short circuit in the relay case. The source of these solder 
particles was considered to be the soldering process to close the evacuation hole of the 
relay; actually, a steel plug was snapped into the hole, and it was sealed by soldering. 
The vendor terminated procurement of these solder- closeout relays on December 3, 

1965. The new sealing process specified that the steel plug be snapped into the evacua- 
tion hole and a ring spotweld be used to seal the hole. This new process was considered 
to be contamination free. However, a total of 1843 of the relays procured before 
December 3, 1965, had already been used in the various MCP flight systems. The iden- 
tification of the specific MCP systems containing the solder- closeout relays was obtained 
from the individual relay serial numbers and the lot traceability for high- reliability 
parts. System 1 for the MCP had 891 of the solder- closeout relays; system 2, 479; 
system 3, 195; system 4, 167; system 5, 81; and system 6, 30. 

After the locations of all the solder- closeout relays had been determined, these 
relays were removed and replaced with welded- seal relays, but the task was not simple. 
One technique was to X-ray the relays in an attempt to determine whether the relays 
contained solder particles. However, the results were unsatisfactory because no con- 
clusive correlation could be made between the analyses of the X-rays and the actual 
opening of the relay case and the physical inspection of the relay for contamination. 

The relay X-ray technique was officially eliminated December 15, 1966. The delay in 
delivery of such a large quantity of relays would result in an unrealistic schedule if 
each solder- closeout relay were to be replaced. On January 9, 1967, a rationale was 
established for exchanging the relays. Circuits dealing with spacecraft recovery were 
top priority, circuits dealing with mission success were second priority, and circuits 
having more than one solder- closeout relay in any redundant path were third priority. 
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The vendor began replacing the relays in accordance with this rationale to meet the 
spacecraft 017 scheduled delivery date of January.21, 1967. Control assemblies and 
plug-in printed circuit boards were exchanged among the MCP systems to ensure that 
correct relays were used in the MCP system for spacecraft 017. System 5 for the MCP 
was delivered to the KSC on January 11, 1967. The scheduled events for spacecraft 017 
at the KSC were delayed so that the allowed schedule relief could be used to incorporate 
more improvements in the MCP. On February 9, 1967, the NASA and the spacecraft 
contractor reviewed the solder- closeout- relay situation, and a mission- event- by-event 
failure- effects analysis was used to arrive at a final determination for relay replace- 
ment. The actual replacement process was difficult because the printed circuit track 
of the control assemblies could be damaged while unsoldering the relay. The problem 
was finally corrected when all the solder- closeout relays in critical circuits had been 
replaced with welded- closeout relays. 


Polarized Tantalum Capacitor Failures 

During the spacecraft Oil postflight test, the MESC interface test, and the normal 
mission plugs- out test, a 3- second time delay in the MCP circuit (separation- abort 
command) to the MESC was timing out in approximately 4. 7 seconds. During the failure 
investigation, the problem was isolated to a polarized tantalum capacitor in the filter 
circuit for the 28- V dc buses A and B. This 5- microfarad capacitor was used for filter- 
ing emi. Also, another filter capacitor in a different circuit was found to be failed. 

The emi filters were added to the MCP during the breadboard development testing to 
protect the time delays from bus- voltage spikes or transients of 4 microseconds or less 
duration. These transients could prevent the time delays from reinitializing and re- 
starting their time cycles. The time delays normally restart their time cycles after 
power has been removed and reapplied; therefore, a negative noise spike greater than 
28 V dc would momentarily cancel the 28- V dc "on" signal to the time delay and would 
cause a recycle to zero. The instant the spike disappeared, the timer would begin 
timing again. For example, if a noise spike occurred at 1. 7 seconds from t = 0 and 
was greater than -28 V dc, the spike would cause the 3- second time delay to restart, 
with the additional normal 3- second timeout totaling 4. 7 seconds. The failure mode 
could also occur with the transient dropping the MCP voltage (e. g., to 5 volts, after the 
time delay had been on for 2. 7 seconds). Because the capacitor in the resistance- 
capacitance timing circuit does not start charging from the zero- voltage point, the 
charging time constant would be less, and only 2 seconds instead of the normal 3 seconds 
would be required, resulting in a 4. 7- second time delay. These examples only describe 
the failure modes and do not give the exact time the transient occurred. The corrective 
action added more capacitance to the emi filters in the MCP and was incorporated in 
the mission control programer used for spacecraft 017 and 020. 


Time-Delay Failures 


For a 14- month period ending in April 1967, NASA and various aerospace industry 
representatives combined their efforts to resolve the MCP time-delay and fuse-diode 
failures. The failure mode was readily established shortly after the first time-delay 
circuit failed. Transistor (fig, 17) of the time-delay circuit shorted (collector to 


base) causing zener diode CR^^ to overload. 


exceed the thermal rating, and fail, so that 
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Figure 17.- Time-delay circuit schematic. 


the fuse diode on the time-delay input was overloaded and failed (open circuit). Numer- 
ous attempts were made to establish the cause of the failure. The following list of 
significant events in the investigation indicates the amount of study on this problem. 

1. In February 1966, the first 1-second time-delay failure occurred while the 
control assembly was being checked during manufacturing buildup and was then resolved 
as an operator error (overstress). 

2. On March 6, 1966, the MCP was installed in spacecraft Oil. 

3. On March 22, 1966, an unassociated failure occurred in the SCO, and the unit 
was sent to the vendor for repair. 

4. On March 24, 1966, the failures of two 3-second time-delay circuits in the 
same SCO was discovered during bench testing by the vendor before the repair and 
rework. 

5. On April 2, 1966, the MCP repair was completed by the vendor, and the unit 
was reinstalled in spacecraft Oil to support testing. (At that time, no redundancy test 
of the MCP had been performed by the spacecraft contractor. ) 

6. On July 15, 1966, a 3-second time-delay circuit malfunctioned at the KSC 
during the integrated spacecraft test. (This occasion was the first that redundancy in 
the MCP had been verified in the spacecraft, but the time-delay circuit could have 
failed earlier. ) 

7. On July 16, 1966, SCC unit 1 was replaced with unit 4. 
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8. On August 10, 1966, during the flight readiness review, the representative 
for the vendor explained that each time- delay network was checked in the MCP by the 
bench test equipment before delivery, that a transient energy level of 250 V dc for 

50 microseconds was required to break down the transistor, that the bench equipment 
had been instrumented to search for transients, and that 43 V dc was the highest tran- 
sient determined. (The transistors are rated for 80 V dc. ) Therefore, the representa- 
tive concluded that the transient must be coming into the MCP from spacecraft wiring. 
This assumption was reasonable because inverter failures and other high-voltage 
spikes had previously been discussed at the flight readiness review. A recommendation 
was approved to put four 18- V dc zener diodes across the MCP input direct- current 
power buses in the spacecraft circuits external to the MCP. 

9. On August 14, 1966, the zener diode network was approved for installation 
in spacecraft Oil. 

10. On September 8, 1966, the zener diode modification was installed and opera- 
tional in spacecraft 017. 

11. In September 1966, 8-, 3-, and 0. 5-second time-delay circuits were found to 
have failed in SCC unit 5, which was supporting the spacecraft 017 tests. (These fail- 
ures were found after the zener diode modification. ) 

12. In October 1966, the vendor continued to study the failures, attempted to 
correlate the high- reliability lot traceability, and analyzed the testing procedures. 

Two more time-delay failures were found in SCC unit 5. 

13. On November 2, 1966, a special resistance check was devised to verify the 
operation of 3- and 0. 2- second time- delay circuits at the KSC just before launch of 
spacecraft 017. 

14. In November 1966, the vendor's test equipment was modified to incorporate 
the zener diode fix. 

15. On December 12, 1966, a time-delay failure was found in SCC unit 6. 

16. In December 1966, dual- redundant capacitors were added to the emi filters 
to solve the polarized tantalum capacitor-failure problem discussed previously. 

(During this investigation, the engineers discovered the large potential charge that 
these filter capacitors could store. ) 

17. In January 1967, two more time-delay failures were found in SCC unit 6, and 
a detailed extensive investigation was implemented. 

18. In February 1967, the insulation- resistance megohm test used during accept- 
ance testing was determined to be the cause of the failures. After the megohm test was 
eliminated and a multimeter was used to check the insulation resistance, no more time- 
delay failures occurred. 

19. On April 6, 1967, the problem Awas officially closed. 
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The extensive engineering investigation to resolve the time- delay failures revealed 
that this failure, as well as several others, resulted from the transients caused by the 
500-V dc megohm portion of the unit-level test at the vendor's facility. Failure of 
8 diodes, 4 capacitors, 22 fuse diodes, and 14 time delays could be attributed directly 
to these transients. The listed failures were of an induced nature. During factory test, 
components were stressed beyond their capacity by an action of the test operator, who 
was not aware of the consequences. The action consisted of shorting an internal 
ground (G^^, G^, or Gg) to the frame of the SCC after the megohm test. (Refer to 

points A to B in fig. 17. ) This action was taken by the test operator to avoid electrical 
shock from filter capacitors that had been charged to several hundred volts when the 
megohm test voltage was applied to the frame of a control assembly in the SCC. The 
control assemblies were insulated from the frame, and this insulation was tested each 
time by the megohm test unit. The test specification required that 500 V dc be applied 
across a test point on the control assembly to the SCC frame for 2 minutes, then the 
insulation resistance would be read. During this 2- minute period, the filter capacitors 
were charged through the multitude of relay, time-delay, and differentiator paths. 

The resistance- capacitance time constant was 48 seconds (6 megohms x 8 micro- 
farads = 48 seconds). Therefore, the fUter capacitors would charge up to about 
350 V dc in 1 minute and to greater than 400 V dc in 2 minutes. Voltage from the meg- 
ohm test unit could be applied in either polarity. Test personnel reported that because 
no polarity requirement was stated in the specification, the test was performed without 
regard to polarity. As a result, the filter capacitors were charged either negative or 
positive with equal probability for any particular test. 

Discussions with test personnel indicated that, instead of placing the megohm test 
probe on the control assembly test point, it was more convenient to touch a screw near 
the connector of the assembly. The screw was adjacent to exposed terminals that were 
part of the diode circuit. The probe could accidentally slip off the screw and contact 
the terminals. When this happened, the time constant for charging the filter capacitors 
was brief, and the capacitors charged up to slightly less than 500 V dc. To eliminate 
the possibility of electrical shock after completion of the insulation- resistance test, 
the test operator would usually short an internal ground terminal (Gj^> Gg, or Gg) to the 

SCC frame, but sometimes the operator would short the metal plate of the control 
assembly to the frame. At the instant the short was applied, certain components in the 
command controller would be subjected to high electrical stresses. At times, this 
stress would exceed the breakdown strength of one or more components and subsequently 
resulted in a large transient current when the unshorted filter capacitors discharged. 

Laboratory tests of transistor Q^, used in the time- delay circuits (fig. 17), were 

performed to determine the collector-to-base breakdown strength under pulse condi- 
tions. The test consisted of superimposing a positive pulse on a 28-V dc signal on the 
collector of transistor in a time-delay circuit. The circuit was repeatedly pulsed, 

increasing amplitudes in 10- volt increments to 228 V dc (maximum pulse amplitude 
plus 28 V dc) or until failure, whichever occurred first. Fifty- six transistors were 
tested in the laboratory under these conditions, and 35 transistors failed. Each time a 
transistor failed, zener diode CRj was also overstressed and failed. The failed 
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transistor and zener diode had degraded or shorted junctions that were essentially the 
same as the failed parts in the SCC units of the MCP. During the laboratory test, the 
lowest pulse input to cause failure was at 108 V dc (28 V dc plus an 80- volt pulse). 

Six failures occurred at input signals of less than 150 V dc, 10 at less than 170, 20 at 
less than 198, and 35 at less than 228. Thirty of the transistors failed on the first 
voltage pulse at the failure level, five transistors failed by the fifth pulse. The 21 tran- 
sistors that did not fail were ultimately pulsed 170 times at 228 V dc. After the cause 
of failure had been determined, it remained to be proved that the components that had 
not failed were not degraded by the megohm tests, even though they seemed to function 
satisfactorily. Three of the 21 transistors were selected at random and were pulsed 
for a minimum of 43 000 cycles without a failure. Therefore, the misapplication of the 
megohm test could cause immediate failures but would not cause the components to be 
degraded and susceptible to subsequent failure. 

On the basis of the vendor’s successful isolation of the cause of the failures, its 
proper corrective action to prevent future occurrences, and its demonstration that 
existing time-delay transistors in the MCP were not degraded, the problem was closed 
on April 6, 1967. 


Cracking of Glass Seals Caused by 
Clipping of Relay Pins 

The problem involving cracked glass seals did not adversely affect a program or 
a spacecraft, because the only two failures occurred in qualification unit 1 during the 
postflight test of spacecraft 011. The specification required that all component leads 
that mount on printed circuit boards shall not protrude through the board more than 
0. 76 millimeter (0. 030 inch). The relays, diodes, transistors, and other electrical 
components using glass- to- metal seals around their leads (or pins) were discovered to 
be subject to a shock wave during the process of clipping the pin. This shock wave was 
transferred down the pin and could possibly crack the glass seals. (The wire cutters, 
diagonal- cutting pliers, or side-cutting pliers use a wedge or chisel effect to separate 
the wire.) At the instant of final metal separation, rather severe forces (or shock 
waves) were transferred along the wire. 

The problem with the MCP relays was a result of the vendor's fabrication tech- 
niques, which required the leads to be clipped. The relays, including the pin seals, 
were first inspected and then inserted in the circuit boards; the leads were clipped, the 
cut pins were soldered, and the solder was inspected. (At this time, the relay-pin 
seals could not be seen. ) The clipping operation mechanically stressed the relay pins 
and cracked some of the glass seals. 

Whenever a glass seal cracked or the relay pin became loose in the glass seal, the 
pin was free to rotate; merely the wrist action of the technician clipping the pin could 
rotate the pin and alter the critical relay contact alinement (fig. 18). The manufacturing 
alinement procedures required that the contacts first be set at a minimum 
0. 127- millimeter (0. 005 inch) clearance. An overtravel adjustment was then checked 
and established at 0. 0635 millimeter (0. 0025 inch) to effect the proper wiping action of 
the relay contacts and then the proper electrical transfer. Alinement of the contacts 
had to be within ±3°. A projected viewgraph, which magnifies the contacts many times 
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(b) Top view of relay pins with contacts (c) Cross section of pin entering relay 

in open configuration. header and the glass seal. 

Figure 18.- Relay schematics to describe glass-seal problem. 


their actual size, was used by the manufacturer to inspect and check these adjustments. 
Failure or improper action of the relays could occur for insufficient contact gaps or for 
contact gaps with too great a clearance. To prevent future problems, the vendor elimi- 
nated the relay clipping during the manufacturing process. An NASA Flight Safety Infor- 
mation Bulletin was published to notify all Apollo Program participants of the hazards 
of clipping terminals with glass- to- metal seals. 

FLIGHT PERFORMANCE 


The MCP served the three final unmanned Apollo flights without a flight anomaly 
caused by the system. The following discussion of the three spacecraft gives more 
details concerning the flight performance. 

Mission AS-202 

Apollo mission AS-202 (spacecraft Oil), using an uprated Saturn I launch vehicle, 
was launched on February 26, 1966. The MCP consisted of SCC unit 4, GCC unit 1, 
and ADS unit 1. The MCP system configuration production unit numbers are given to 
emphasize that SCC unit 4 was refurbished to serve as a spare for spacecraft 017 and 
020. The contractor was officially notified on October 12, 1966, to perform this 
refurbishment. The MCP was the first Apollo system to be considered for reuse in 
flight. 
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The postlaunch report for mission AS- 202 stated that the MCP "automated the 
sequential event controls that would be normally operated by the flight crew. " The 
report also stated that these sequential event controls, which included the MCP, "func- 
tioned satisfactorily throughout the flight, and the related test objectives were met. " 
The only problem mentioned was a data- sampling-rate problem. Measurements 
CE0321X and CE0322X (parachute disconnect at landing) were not received by 
telemetry. The MCP disconnected the parachutes after landing but turned off the logic 
bus power 35 to 40 milliseconds after the parachutes were disconnected. This sequence 
was normal but it did not allow sufficient time for the telemetry, which had a sampling 
rate of 10 samples per second (100 milliseconds between samples), to receive the sig- 
nal before the bus power was removed. 


Apollo 4 Mission 

The Apollo 4 mission (spacecraft 017) was launched on November 9, 1967. 

Apollo 4 was the first mission to use a Saturn V launch vehicle. The Apollo 4 Mission 
Report stated that "sequencing of the mission control programer was satisfactory 
throughout the mission. " The mission report continued as follows: "The mission con- 
trol programer Avas primarily a passive device, and no specific instrumentation was 
included for its analysis. Verification of continuity at the proper time was the only 
criterion considered during evaluation of this programer. Proper performance was 
indicated throughout the mission. " The report could have included a statement that the 
MCP was used for unmanned missions only and that the flight downdata link could not 
provide measurements for the unmanned system; therefore, other interfacing system 
measurements were evaluated to determine the MCP performance. 

The postflight tests of the MCP, as stated in the mission report, evaluated the 
MCP redundancy and verified that the programer had functioned properly. A more 
detailed and complete inspection of the MCP was performed by the manufacturer during 
the process of refurbishing the MCP for use as a spare for spacecraft 020. This refur- 
bishment was successfully accomplished because the same MCP flown on spacecraft 017 
was subsequently flown on spacecraft 020. 


Apollo 6 Mission 

The Apollo 6 mission (spacecraft 020) was launched on April 4, 1968. Apollo 6 
was the second mission to use a Saturn V launch vehicle and was the last unmanned 
Apollo mission. The Apollo 6 Mission Report stated that "sequencing of the mission 
control programer was satisfactory throughout the mission. " A brief mention was made 
concerning the stable I and stable II flotation attitudes. "The Apollo 6 mission was the 
first mission in which the command module assumed the stable II (inverted) flotation 
attitude after landing. " The ADS unit of the MCP correctly sensed this attitude and 
initiated the sequence that uprighted the spacecraft. 

The mission report continued: "The mission control programer supplied control 
function inputs to various systems during the flight. No specific instrumentation was 
designed to analyze programer performance; however, verification of continuity at the 
proper time showed proper programer performance throughout the mission. " This 
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statement is true of all the MCP flight evaluations. No measurement points were avail- 
able to determine the MCP outputs directly. The sequencing and performance of the 
interfacing systems that were instrumented could be evaluated and thereby allow an 
indirect determination of the MCP performance. 

The Apollo 6 report also stated that "the same programer (except for the altitude 
and deceleration sensors) was used on the Apollo 4 and Apollo 6 missions. " This MCP 
had been refurbished to serve as a spare for spacecraft 020, and a test anomaly at the 
KSC resulted in the spare MCP (which was previously flown on Apollo 4) being installed 
in spacecraft 020. The NASA management decided to reuse this MCP after a thorough 
analysis at the flight readiness review. 


CONCLUDING REMARKS AND RECOMMENDATIONS 


Unmanned Flight Planning 

The requirements for unmanned flights should be established early in the mission 
planning to prevent changes from affecting the hardware design. The design of the 
unmanned sequencing units should be as flexible as possible with the realization that, 
in dynamic programs for space flights, several mission changes are inevitable. 

The items and sequences that are subject to change during unmanned flights (such 
as tape recorder sequencing, camera sequencing, gimbal actuator motor "off" and 
"on" times, and developmental instrumentation sequencing) should be placed in a soft- 
ware program or in some erasable memory device so that the items could be readily 
changed without affecting the hardware design. 


Development Schedule 

The development of the mission control programer was delayed by the NASA up to 
2 years compared to other electrical subsystem developments; the programer was 
started in 1964 while other subsystems were started in 1962. In future space-flight 
programs, the unmanned test flight hardware should be planned and scheduled with 
priorities similar to those of the operation hardware to allow sufficient time for hard- 
ware test and evaluation. 

A minimum of 6 months should be allowed in the development schedule between 
breadboard system delivery and production system delivery for hardware as complex 
as the mission control programer. Doing so would allow a proper evaluation of the 
breadboard with the test results being returned to hardware design before the hardware 
is produced. The required hardware changes could then be made on a lower cost basis. 


Test and Test Equipment 

The 6-month certification period required for the automated factory test equip- 
ment designed for the mission control programer was not excessive. The design for 
test equipment that is to be used for small total quantities of deliverable systems should 
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be, as far as possible, relatively simple, flexible, and general purpose. Engineering 
man-hours could have been better expended in actually testing the hardware manually 
(for each of the six programer systems delivered) rather than in preparing automated 
equipment to run the actual acceptance test in less time. The test equipment flexibility 
should be such that it can be easily reconfigured and recertified for the numerous, 
expected flight-hardware modifications. 

The unmanned flight hardware should be designed to conform to the same space- 
craft test procedures that are used for the operational hardware. For example, if the 
spacecraft method of verifying operational redundancy was removal of power to sys- 
tem A to verify system B and vice versa, the unmanned equipment design should be 
compatible with the planned operational test methods. 

During the mission control programer time-delay-failure investigation, experience 
indicated that the detailed test procedures at all levels of systems test must be followed 
exactly by each operator. Even slight variations from the established procedures can 
cause many unsuspected problems. 


Hardware Problems 

The mission control programer relay failures can generally be attributed to an 
early method of solder sealing the evacuation and gas-filling hole. The solder sealing 
process would sometimes result in solder particles inside the relay case; the particles 
floated across the contacts in the zero-g environment. A new sealing process was 
developed in which a steel plug was snapped into the relay evacuation hole, and a ring 
spotweld sealed the plug to the case. The new welding method ended the solder- 
contamination problem. It is recommended that solder- sealed relays not be used on 
future space flights. 

Experience indicated the ineffectiveness of using X-ray techniques to identify 
relays that had solder particles in the sealed cases. Without opening the sealed cases, 
no correlation could be achieved between cases actually not containing solder particles 
and those that the X-ray techniques indicated as not containing the particles. 

The time- delay failures resulted in the most extensive failure analysis and inves- 
tigation activity that occurred during the mission control programer development. One 
area that was misleading during the failure analysis was that each time delay was 
verified "good" during the programer contractor's acceptance test just before delivery 
from the factory to the spacecraft; then, after the programer was installed in the vehicle 
for the test support/interface verification activity, one to three time delays indicated 
"failed" during the first spacecraft test of programer redundancy. The failure mode 
was finally determined to be that the time-delay transistors failed "open circuit" by the 
sudden discharge of a 500- volt potential that had been stored in the filter capacitors 
during the megohm insulation test at acceptance. Only after much investigation was it 
determined that the test operator shorted the filter capacitor to ground (not a normal 
documented test procedure) just before delivery of the programer from the acceptance 
test area. The discharge current followed several sneak paths and would burn out one 
or more of the time-delay transistors. The corrective action was to stop the megohm 
insulation test as part of acceptance. Future programs should ensure that test operators 
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be cautioned to follow the test procedures exactly and not add any unique procedure 
such as manually discharging capacitor charge buildups as the unit is removed from the 
teststand. After the 500- volt insulation check was eliminated, no transistor failures 
occurred. Future electronic test designers should be especially aware that large filter 
capacitors can store voltages of a sufficient level to damage low- voltage- level devices. 


Lyndon B. Johnson Space Center 
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